1 of 27

Lessons Learned – �The Importance of Being �a Wise Person

Dr. Deborah Hill

13^th November 2024

WPC Webinar Series

2 of 27

Introduction to Me …

NNL Criticality Technical Leader and NNL Senior Fellow in Criticality Safety {Plus Head of NNL Fellowship} �
Over 25 years of experience as a practicing criticality safety assessor�
Former Chair of the UK Working Party on Criticality �
Former Chair of the American Nuclear Society �Nuclear Criticality Safety Division�
I enjoy working in criticality safety as much today as I did 25 years ago ! But this talk definitely isn’t about me “imparting my wisdom” … !

2

National Nuclear Laboratory

3 of 27

Where My Fascination with Safety Began … (1)

11 May 1985
Valley Parade, Bradford FC
Known for antiquated wooden design
Initiated by a cigarette end igniting litter under seats
4 minutes for fire to engulf stand
56 deaths�
Could Have Been Prevented – Previous warnings given about a major litter build-up

3

National Nuclear Laboratory

4 of 27

Where My Fascination with Safety Began … (2)

28 January 1986
Space Shuttle Challenger
Broke apart 73 seconds into flight
Initiated by a low temperature failure of O-rings in rocket booster
7 deaths�
Could Have Been Prevented – Known design issue (since 1977); widely reported that engineers were overruled on launch day

4

National Nuclear Laboratory

5 of 27

Where My Fascination with Safety Began … (3)

26 April 1986
No. 4 reactor at Chernobyl
Low power experiment
Explosion and fire
4000 estimated deaths
Plume affected whole of Europe�
Could Have Been Prevented – Flawed reactor design; untrained personnel; safety measures ignored

5

National Nuclear Laboratory

4000 deaths estimated by the World Health Organisation�
During a planned decrease of reactor power in preparation for the test, the operators accidentally dropped power output to near-zero, due partially to xenon poisoning.
While recovering from the power drop and stabilizing the reactor, the operators removed a number of control rods which exceeded limits set by the operating procedures. Upon test completion, the operators triggered a reactor shutdown by dropping the control rods.
Due to a design flaw, this action resulted in localized increases in reactivity within the reactor. Brought about the rupture of fuel channels and a rapid drop in pressure, thereby prompting the coolant to flash to steam.
Neutron absorption thus dropped, leading to an increase in reactor reactivity, which further increased coolant temperatures (a positive feedback loop).
This process led to steam explosions and the meltdown of the reactor core.

6 of 27

Where My Fascination with Safety Began … (4)

As a Teen …

As a *cough* Year Old …

6

National Nuclear Laboratory

7 of 27

How Does “Being Wise” Come Into It … ?

7

National Nuclear Laboratory

8 of 27

Theory of Accidents … (1)

KEY MESSAGE: Accidents are rarely as a result of one thing going wrong – often a number of�factors have to align … {A concept called upon in safety cases – “defence in depth”}

8

National Nuclear Laboratory

9 of 27

Theory of Accidents … (2)

Similar pictures could be drawn for all accidents back in 1985 / 86 …

9

National Nuclear Laboratory

10 of 27

Last Criticality Accident … (1)

30^th September 1999
JCO Tokaimura, Japan
Non-routine operation at higher enrichment (18.8 ^w/_o ²³⁵U)

Day 1 – Dissolved four 2.4kg batches
Day 2 – Dissolved three 2.4kg batches� {Batch was 45% of a critical mass}�
Criticality occurred; sustained for �17 hours until shutdown

10

National Nuclear Laboratory

11 of 27

Last Criticality Accident … (2)

No explosion or damage to vessels
2 fatalities, prison sentences
Facility “Licence to Operate” revoked�
What Contributed to Event ?

- Unapproved (procedural) changes

- Production pressures � - Infrequent operation

- Lack of operator awareness / training� - “Not a credible event”

11

National Nuclear Laboratory

12 of 27

But We Can Only Learn from Criticality Accidents, Right ... ?

The following few slides illustrate the lessons we can learn from other industries ...

12

National Nuclear Laboratory

13 of 27

Accident 1 – Flixborough Disaster ... �

1 June 1974
Explosion of flammable hydrocarbon
Initiated by a flawed bypass of a vessel
28 deaths�
Contributing Factors� - No mechanical engineer input� - Pressure to restart�

Reflection – Illustrates the importance of (i) plant modification procedures with Suitably Qualified & Experienced Person (SQEP) input, and (ii) minimum manning levels

13

National Nuclear Laboratory

14 of 27

Accident 2 – Tenerife Airport Disaster ... �

27 March 1977
One flight collided with rear of another on runway
Initiated by a communication error
583 fatalities�
Contributing Factors

- Increased air traffic

- Reduced visibility (fog)� - Time pressures� - Air Traffic Control distracted by football match

- Failure to challenge senior pilot

- Senior pilot not flown for 12 weeks�

Reflection – Illustrates the importance of human factors input

14

National Nuclear Laboratory

15 of 27

Accident 3 – Paddington (Ladbroke Grove) Rail Crash ... �

5 October 1999
2 Trains Collided
Initiated by driver passing a “danger” signal set� {Had happened 8 times in last 6 years}
31 Deaths�
Contributing Factors

- Driver qualified two weeks before crash

- Impaired visibility of signal

- Driver not trained on recent near misses

- Complacency about dire consequences of hazard

Reflection – Illustrates that (i) not SQEP overnight, and (ii) the best technology isn’t always the right technology

15

National Nuclear Laboratory

16 of 27

Accident 4 – Buncefield Fire ... �

11 December 2005
Explosion from leaking petrol tank
Initiated by level gauge control failing� {Had been sticking in August but not deemed a concern}
43 injuries�
Contributing Factors

- High-level switch & alarm failed {not locked}

- Deficient management checks

- Overall throughput increased, reducing fill times�

Reflection – A reason for DB2 class !

16

National Nuclear Laboratory

17 of 27

What is the Relevance to Criticality Safety ... ?

SOME COMMON CAUSES

Human error is a dominant cause in every case
Multiple faults (some unrevealed / not addressed)
Production / efficiency pressures
Lack of operator training / experience
Lack of appropriate supervision
Unapproved change
Non-routine operations
“Not considered credible”� �

17

National Nuclear Laboratory

18 of 27

What is the Relevance to Criticality Safety ... ?

SOME COMMON CAUSES

Human error is a dominant cause in every case TENERIFE
Multiple faults (some unrevealed / not addressed) BUNCEFIELD
Production / efficiency pressures FLIXBOROUGH
Lack of operator training / experience PADDINGTON
Lack of appropriate supervision BUNCEFIELD
Unapproved change FLIXBOROUGH
Non-routine operations TENERIFE
“Not considered credible” PADDINGTON� �

But other lessons we can learn as well ...

18

National Nuclear Laboratory

19 of 27

Accident 5 – RAF Nimrod ... (1)

2^nd September 2006
RAF Nimrod over Helmand Provence, Afghanistan
Catastrophic mid-air failure following refuelling
14 deaths�
7 related events in preceding 15 year period

19

National Nuclear Laboratory

20 of 27

Accident 5 – RAF Nimrod ... (2)

20

National Nuclear Laboratory

21 of 27

Accident 5 – RAF Nimrod ... (3)

21

National Nuclear Laboratory

22 of 27

Accident 5 – RAF Nimrod ... (4)

SAFETY CASE SHORTCOMINGS

Bureaucratic Length
Obscure Language
Wood-For-The-Trees
Archaeology
Routine Outsourcing
Lack of Vital Operator Input
Disproportionate
Ignoring Aging Issues
Compliance Only
Audits
Self-Fulfilling Prophecies
Not Living Documents

22

National Nuclear Laboratory

Bureaucratic Length – Introduced the “thud factor”.
Obscure Language – Been written in a way to make situation sound as positive as possible (e.g. hid Shortfalls).
Wood-For-The-Trees – Over 1300 hazards identified which were assessed in a similar fashion, irrespective of significance.
Archaeology – Demonstrated that complied with the relevant safety and certification requirements at the time of build.
Routine Outsourcing – To people who have never operated / maintained (or in some cases even seen) the platform.
Lack of Vital Operator Input – Heavy involvement from designers but not operational staff.
Disproportionate – Spent ~ £400K on the safety case. A general feeling that (i) woefully inadequate resource estimates, and (ii) most money spent on “paper safety” rather than actual improvements.
Aging Issues – Treated as new and not 30 years old (and all of the issues related to that).
Compliance Only – Critical of prescriptive regulation – over-complex and detracts from safety consideration. {Found false comfort in compliance and box-ticking}
Audits – Focus on processes and paper rather than what actually happening on the ground.
Self-Fulfilling Prophecies – Proving what was already known (& hence the safety case didn’t matter).
Not Living Documents – Failed to react and update when events occurred after the event.

23 of 27

Takeaway Message ...

23

National Nuclear Laboratory

24 of 27

Shameless Plug – Criticality LFE Databases ...

WPC MEMBER ORGANISATIONS ...

Recently converted into a US tool which is currently being “soft launched” ... �- https://ncsp.llnl.gov� �

24

National Nuclear Laboratory

25 of 27

Final Thought …

24^th July 1915
SS Eastland
Capsized, with 844 deaths�
Original design flaw - top heavy boat
Titanic accident prompted retrofit of �5 new lifeboats, 37 life rafts, �2570 lifejackets – all up top …
No tests of effect on boat stability�
Moral is “apply any learning smartly” – more is not necessarily better !

25

National Nuclear Laboratory

26 of 27

Not protectively marked

27 of 27

Thank you

National Nuclear Laboratory�5th Floor, Chadwick House�Warrington Road, Birchwood Park�Warrington WA3 6AE�T. +44 (0) 1925 933 744�E. customers@uknnl.com

www.nnl.co.uk